CISA added Fortinet CVE-2025-61624 to KEV after Unit 42 tied it to PEERSTITCH, a memory-resident FortiGate implant. Patch or migrate, then hunt memory and rotate centrally stored credentials.
The FBI and Secret Service say FortiBleed remains active against FortiGate firewalls and SSL VPNs, with administrator lockouts, ransomware access and new indicators requiring immediate review.
Fortinet now lists fixed FortiMail builds for exploited CVE-2026-104286. Its log indicators show a rogue archive account sending data to attacker infrastructure, a change that survives the upgrade.
Fortinet has released fixed builds for CVE-2026-104286. Upgrade FortiMail now, then check archive accounts, cron activity and files for evidence of compromise.
